CVE-2026-58126: PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service

Synopsis

An unauthenticated remote code execution vulnerability affects PACSgear PACS Scan 5.2.1 via an exposed .NET Remoting TCP service on port 22222. The service requires no authentication and is reachable over the network, allowing any attacker who can connect to read and write arbitrary files, then escalate to code execution by planting a malicious DLL that the service loads on restart. Successful exploitation gives the attacker full SYSTEM-level control of the host. No vendor patch has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach port 22222 on the target host over the network; the .NET Remoting TCP service is exposed with no network-level access restriction by default.

• AuthenticationNot required

  No credentials or session token of any kind are required; the service accepts unauthenticated connections.

• Victim interactionNot required

  No user action is needed; the attacker contacts the service directly without any social-engineering step.

• Attack complexityDetail

  Exploitation is reliable and condition-free at the file read/write stage; the DLL hijacking step requires a service restart, which may occur naturally or be triggered by an attacker with write access to configuration files.

Blast Radius

• Reads arbitrary files on the host filesystem, including credentials, configuration data, and medical imaging records stored by the PACS application.
• Writes arbitrary files to any path accessible by the service process, enabling replacement or creation of files across the system.
• Plants a malicious DLL in the application directory that the service loads on restart, achieving code execution as NT Authority\SYSTEM.
• Full SYSTEM-level control of the host allows the attacker to pivot to adjacent systems, disable security tooling, or exfiltrate the entire data store.